https://github.com/oauth-wg/draft-ietf-oauth-resource-metadata/pull/54
addresses this request. It reuses the metadata parameter name
authorization_details_types_supported from
https://www.rfc-editor.org/rfc/rfc9396.html.
-- Mike
From: Ralph Bragg <[email protected]>
Sent: Friday, September 13, 2024 8:34 PM
To: Michael Jones <[email protected]>; [email protected];
[email protected]
Subject: Feedback on OAuth 2.0 Protected Resource Metadata
Hi,
Can I please request that additional metadata types for describing resource
access requirements be included from the RAR specification
(https://datatracker.ietf.org/doc/html/rfc9396#name-relationship-to-the-scope-p)
in the
https://www.ietf.org/archive/id/draft-ietf-oauth-resource-metadata-09.html
specification.
RAR is an alternative to scopes and the use of only one way to convey
authorization to access the resource is recommended in the RAR spec.
Combined use of authorization_details and scope is supported by this
specification in part to allow existing OAuth-based applications to
incrementally migrate towards using authorization_detailsexclusively. It is
RECOMMENDED that a given API use only one form of requirement specification.".
Oauth resource servers that have moved to supporting rar should be able to
advertise using the oauth resource metadata specification the rar types that
are required to access the resource in a similar way to scopes.
Thank you for your consideration for this change as I understand this draft is
in last call.
Kind Regards,
Ralph
Ralph Bragg
Chief Technology Officer
M.
+447890130559
T.
0203 148 6609
[email protected]<mailto:[email protected]>
[https://storage.letsignit.com/icons/designer/socials/Linkedin--circle--black.png]<https://cloud.letsignit.com/collect/bc/652d0421e161c54081b81962?p=TMTQYP7uhVuEibYQ91RsC3IoNUOt5RBT8PxKu46ijB200WFOdFgfuybDSNA7VsIsDfVuTvGEfkoMzngn2LEx6sZgJoSeY6SRq4DADGvENbcrCp3R8bPY3ukqcgnAE1QBOE1aeRl-_3D7UXCGJdZ1M7e1qUDa1Q4HzoARy0RaSJE=>
[https://storage.letsignit.com/5fd527570105a500075428f0/generated/effects_08e3e03b4f71b6a89cf4bd9f429daac0a7f6dd1ccb38a410fc760991.png]
The content of this email is confidential and intended for the recipient
specified in message only. It is strictly forbidden to share any part of this
message with any third party, without a written consent of the sender. If you
received this message by mistake, please reply to this message and follow with
its deletion, so that we can ensure such a mistake does not occur in the future.
_______________________________________________
OAuth mailing list -- [email protected]
To unsubscribe send an email to [email protected]
